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The FAA-sponsored Sense and Avoid Workshop for Unmanned Aircraft Systems (UAS) 
defines the concept of sense and avoid for remote pilots as “the capability of a UAS to 
remain well clear from and avoid collisions with other airborne traffic.” Hence, a rigorous 
definition of well clear is fundamental to any separation assurance concept for the inte- 
gration of UAS into civil airspace. This paper presents a family of well-clear boundary 
models based on the TCAS II Resolution Advisory logic. For these models, algorithms 
that predict well-clear violations along aircraft current trajectories are provided. These 
algorithms are analogous to conflict detection algorithms but instead of predicting loss of 
separation, they predict whether well-clear violations will occur during a given lookahead 
time interval. Analytical techniques are used to study the properties and relationships 
satisfied by the models. 
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Acronyms 

CAT 

NAS 

NMAC 

RA 

SAA 

SST 

SSV 

TCAS 
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Horizontal distance parameter 

Horizontal distance and time thresholds 

Distance at closest point of approach 

Numerical parameter whose value is ±1 

Two-dimensional aircraft state, i.e., position and velocity 

Vertical aircraft state, i.e., altitude and vertical speed 

Time variable 

TCAS II tau and modihed tau 
Time to closest point of approach 
Time to entry point 
Time to co-altitude 
Vertical distance and time thresholds 

Ownship and intruder information of a position or velocity vector 
Northern, eastern, and altitude component of a position or velocity vector 

Collision Avoidance Threshold 
National Airspace System 
Near Mid-Air Collision 
Resolution Advisory 
Sense and Avoid 
Self-Separation Threshold 
Self-Separation Volume 

Traffic Alerting and Collision Avoidance System 
Time to Closest Point of Approach 
Unmanned Aircraft Systems 
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I. Introduction 


One of the major challenges of integrating Unmanned Aircraft Systems (UAS) into the airspace system 
is the lack of an on-board pilot to comply with the legal requirement that pilots see and avoid other aircraft 
in their vicinity. To address this challenge, the hnal report of the FAA-sponsored Sense and Avoid (SAA) 
Workshop for Unmanned Aircraft Systems [2] defines the concept of sense and avoid for remote UAS pilots 
as “the capability of a UAS to remain well clear from and avoid collisions with other airborne traffic.” Under 
this definition, a rigorous definition of well clear becomes fundamental to any sense and avoid concept that 
involves UAS. 

NASA’s Unmanned Aircraft Systems Integration in the National Airspace System (UAS in the NAS) 
project aims at conducting research towards the integration of civil UAS into non-segregated airspace op- 
erations. As part of this project, NASA has developed a sense and avoid concept for UAS that extends 
the concept outlined by the SAA Workshop [1]. The NASA concept includes a volume, namely the Self 
Separation Volume (SSV), located between the Collision Avoidance Threshold (CAT), defined by collision 
avoidance systems, and the Self-Separation Threshold (SST), defined by self-separation systems [2]. The SSV 
represents a well-clear boundary where aircraft inside the SSV are considered to be in well-clear violation. 
This volume is intended to be large enough to avoid safety concerns for controllers and see-and-avoid pilots, 
but small enough to avoid disruptions to traffic flow. A key characteristic of NASA’s concept is that the 
SSV is a conservative extension of the CAT defined by the Traffic Alerting and Collision Avoidance System 
(TCAS). 

TCAS is a family of airborne devices that are designed to reduce the risk of mid-air collisions between 
aircraft equipped with operating transponders [10]. TCAS II, the current generation of TCAS devices, 
is mandated in the US for aircraft with greater than 30 seats or a maximum takeoff weight greater than 
33,000 pounds. Although it is not required, TCAS II is also installed on many turbine-powered general 
aviation aircraft. Version 7.0 is the current operationally-mandated version of TCAS II, and Version 7.1 
has been standardized [8]. In contrast to TCAS I, the first generation of TCAS devices, TCAS II provides 
resolution advisories (RAs). RAs are visual and vocalized alerts that direct pilots to maintain or increase 
vertical separation with intruders that are considered collision threats. TCAS II resolution advisories can 
be corrective or preventive depending on whether the pilot is expected to change or maintain the aircraft’s 
current vertical speed. Corrective RAs are particularly disruptive to the air traffic system since they may 
cause drastic evasive maneuvers. For this reason, they are intended as a last resort maneuver when all other 
means of separation have failed. 

The core of the TCAS II RA logic is a test that checks distance and time variables for the horizontal 
and vertical dimensions against a set of pre-defined threshold values. To ensure interoperability between 
NASA’s SSA concept and TCAS, the mathematical definition of the volume SSV is based on the TCAS II 
Resolution Advisory Logic [5]. The definition of SSV follows the same logic, but uses different thresholds 
that conservatively extends the collision avoidance threshold provided by TCAS. 

This paper generalizes the definitions of the well-clear boundary provided in [5] . In particular, it presents 
a family of well-clear boundary models based on different, but related, time variables. Formal techniques 
are used to study properties of these models such as symmetry, local-convexity, and inclusion. For each 
one of these models, an algorithm is provided that computes the time interval during which aircraft are not 
well clear assuming that they continue along their current trajectories. These detection algorithms assume 
the availability of accurate state vector information for the two aircraft. These algorithms completely and 
correctly characterize all encounter geometries that will cause a well-clear violation within a given lookahead 
time, assuming linear aircraft trajectories. 

The formal development presented in this paper is part of the NASA’s Airborne Coordinated Resolution 
and Detection (ACCoRD) mathematical framework, which is electronically available from http : //shemesh. 
larc.nasa.gov/people/cam/ACCoRD. All theorems in this paper have been formally verified in the Prototype 
Verification System (PVS) [7], an automated theorem prover. 
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II. Distance and Time Variables 


Distance and time variables are important elements of any separation assurance concept. These variables 
are functions over the aircraft current states which are compared against distance and time thresholds. Many 
conflict detection and resolution systems rely on the time of closest point of approach and the distance at 
that time as their main time and distance variables [4]. This section describes some additional distance and 
time variables that are particularly relevant to the definition of a well-clear boundary model. 

This paper assumes that accurate aircraft surveillance information is available as horizontal and vertical 
components in a three-dimensional (3-D) airspace. Letters in bold-face denote two-dimensional (2-D) 
vectors. Vector operations such as addition, subtraction, scalar multiplication, dot product, i.e., s • v = 
SxVx + SyVy, the square of a vector, i.e., = s • s, and the norm of a vector, i.e., ||s|| = v^, are defined in 

a 2-D Euclidean geometry. Furthermore, the expression v*- denotes the 2-D right perpendicular of v, i.e., 

= {vy,—Vx), and 0 denotes the 2-D vector whose components are 0, i.e., 0 = (0,0). 

The mathematical models presented in this paper consider two aircraft referred to as the ownship and 
the intruder aircraft. For the ownship, the current horizontal position and velocity are denoted Sq and Vq, 
respectively. Its altitude and vertical speed are denoted Soz and Vozi respectively. Similarly, the horizontal 
position and velocity of the intruder aircraft are denoted and v^, respectively, and its vertical altitude 
and speed are denoted Siz and Viz, respectively. As it simplifies the mathematical development, this paper 
uses a relative coordinate system where the intruder is static at the center of the coordinate system. In this 
relative system, s = Sq — and v = Vq — represent the horizontal relative position and velocity of the 
aircraft, respectively. Furthermore, Sz = Soz — Siz and Vz = Voz — Viz represent the vertical relative position 
and speed of the aircraft, respectively. 

Assuming constant relative horizontal velocity v, the horizontal range between the aircraft at any time 
t is given by 

r{t) = ||s -I- tv|| = -I- 2t{s ■ v) -I- (1) 


The time of horizontal closest point of approach, denoted is the time t that satisfies r{t) = 0, i.e., 
t = The dot product s • v characterizes whether the aircraft are horizontally diverging, i.e., s • v > 0, 

or horizontally converging, i.e., s • v < 0. By convention, is defined as 0 when v = 0. Hence, is 
formally defined as 


Apa(s, v) 


ifv^O, 

otherwise. 


( 2 ) 


It is noted that t,.p,,(s,v) > 0 when the aircraft are horizontally converging, tppp(s,v) < 0 when the aircraft 
are horizontally diverging, and tcpa(s, v) = 0 when the aircraft are neither converging or diverging. The 
distance at time of closest point of approach is defined as 


dppp(s,v) = r{tpp^{s,v)) = ||s-htepp(s,v)v|l. 


( 3 ) 


In the vertical dimension, assuming constant relative vertical speed, the relative altitude between the 
aircraft at any time t is given by 


rz{t) = |sz -I- tVz\. 


( 4 ) 


The time to co-altitude is the time t that satisfies rz{t) = 0, i.e, t = ^. Similar to the horizontal 
case, the product SzVz characterizes whether the aircraft are vertically diverging, i.e., SzVz > 0, or vertically 
converging, i.e., SzVz < 0. This paper defines time to co-altitude as —1 when the aircraft are not vertically 
converging. Therefore, 


tppp.{Sz,Vz) = 


-1 


if SzVz < 0, 
otherwise. 


( 5 ) 


Formula (5) is well defined since SzVz < 0 implies that Vz yf 0. 


II. A. Horizontal Time Variables 

A (horizontal) time variable is a function that maps a relative horizontal position and velocity into a real 
number. This real number is negative when the aircraft are horizontally diverging. When the real number is 
non-negative, this number represents a time that, in a separation assurance logic, is intended to be compared 
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against a time threshold. In this paper, the time threshold is called TTHR. An example of a time variable 
that is used in conflict detection logics is [4]. 

The time variable used in earlier versions of the TCAS detection logic is called tau, denoted r [8]. Tau 
estimates but is less demanding on sensor and surveillance technology than Indeed, t is simply 
defined as range over closure rate, where closure rate is the negative of the range rate, i.e., r = — = 

— 4^ = This paper defines r as — I when the aircraft are not horizontally converging. Formally, 


r(s,v) 



if s • V < 0, 
otherwise. 


( 6 ) 


For a limited number of scenarios, the values of t and coincide. However, in most scenarios, the value 
of r tends toward infinity as the aircraft approach the closest point of approach. In general, r is a good 
approximation of but only for large values. For that reason, TCAS II uses a modified variant of t called 
modified tau, denoted r„od [8]. Modified tau provides a better estimation of Cpa and has a more regular 
behavior than t in the proximity of the closest point of approach. In [3], modified tau is defined such that 
T„od = — • Siaiilar to r, r„od is defined as -I when the aircraft are not horizontally 

converging, i.e.. 


r„od(s, v) 


-1 


if s • V < 0, 
otherwise. 


(7) 


The definition of r„„d in Formula (7) depends on DTHR, which is a horizontal distance threshold. This 
threshold is called DMOD in the TCAS II RA logic and its actual value depends on a sensitivity level based 
on the ownship’s altitude [8]. 

In [6], a time variable called time to entry point, denoted t^p, is proposed. Time to entry point is defined 
as the time to loss of horizontal separation with respect to DTHR assuming straight-line aircraft trajectories. 
Similar to Cp», Ap decreases linearly over time. Time to entry point is formally defined as 


Ap(s,v) 


0(s, V, DTHR, —I) if s • V < 0 and A(s, v, DTHR) > 0, 
— 1 otherwise, 


( 8 ) 


where 


0(s,v,£),e) 


-s ■ V -t €y/A{s,w,D) 

v2 


A(s, V, D) = DW - (s • v-L)A 


(9) 

(10) 


The function 0 is only defined when v 7^ 0 and A(s, v, D) > 0. In this case, it computes the times when the 
aircraft will lose separation, if e = —I, or regain separation, if e = I, with respect to D. When the aircraft 
are not horizontally converging or A(s,v,DTHR) < 0, time to entry point is defined as -I. Formula (8) is well 
defined since the condition s • v < 0 guarantees that v 7^ 0 . 


II. B. Properties of Horizontal Time Variables 

A useful property of a time variable is symmetry. A time variable Aar is said to be symmetric if and only for 
all s, V, 

Aar(s,v) = Aar(-S, -V). (ll) 

Symmetry guarantees that in a pairwise scenario both the ownship and intruder aircraft computes the 
same value for the time variable. Hence, checking a symmetric time variable against a given time threshold 
returns the same Boolean value for both aircraft. 

Theorem 1. The time variables Apo; t, and Ap are symmetric. 
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It is possible to define time variables that are not symmetric. For instance, a time variable that com- 
putes the first time when the intruder aircraft enters an elliptical area aligned to the ownship trajectory 

is not symmetric for every scenario. However, any time variable can be transformed into a symmetric 
one by using min and max operators. For instance, the time variables min(t^„^j(s, v), s, — v)) and 
max(t^„(s, v), s, — v)) are symmetric for any time variable f^ar- 

Figure 1 shows a graph of time vs. r, and t^pa for an initial scenario where the ownship 

and intruder aircraft are located at (0 nmi, — 3.25 nmi) and (—6.25 nmi, 0.25 nmi), respectively, flying at 
co-altitude, the ownship ground speed is 150 kts, heading 53°, and the intruder ground speed is 350 kts, 
heading 90°.®' In this scenario, the distance threshold DTHR used in the definition of and is 1 nmi. 
This scenario illustrates that while t^p, r„pj, and decrease over time, the time variable r decreases up 
to some point, but then it abruptly increases in the vicinity of the closest point of approach. Moreover, 
when these time variables are checked against a time threshold TTHR, represented by the horizontal line at 
30 seconds, the time variable tep crosses the time threshold first, followed by r„pd, and r, in that order. 
Interestingly, this property holds for any converging scenario and any choice of threshold values. 



time (s) 


Figure 1: Time vs. r, t^p 

Theorem 2. Let s,v be such that s • v < 0, ||s|| > DTHR, and dpp„(s,v) < DTHR, i.e., the aircraft are 
horizontally converging, outside the distance threshold DTHR, and their distance at time of closest point of 
approach is less of equal than DTHR, the following inequalities hold 

tep{s, v) < T„„d(s, v) < v) < r(s, v). (12) 

Aircraft headings are measured in true north clockwise convention, i.e., 0° points to the north and degrees are positive in 
clockwise direction. 
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III. A Family of Well-Clear Boundary Models 


A well-clear boundary specifies the set of aircraft states that are considered to be in well-clear violation. 
Following the TCAS detection logic, the well-clear boundary models in this paper are specified by a logical 
condition that simultaneously checks horizontal and vertical violations. A horizontal violation occurs if the 
current range is less than a given horizontal distance threshold DTHR. A horizontal violation also occurs if 
distance at time of closest point of approach is less than DTHR and a given time variable is less than a 
given time threshold TTHR. In the vertical dimension, a similar comparison is made. Vertical well clear is 
violated if the relative altitude is less than a given altitude threshold ZTHR or if the time to co-altitude is less 
than a given vertical time threshold TCOA. The distinct and altitude thresholds are considered to be positive 
numbers, i.e., DTHR > 0 and ZTHR > 0. The time thresholds are considered to be non-negative, i.e., TTHR > 0 
and TCOA > 0. Formally, this well-clear violation condition can be denoted as follows. 

IFC'yt^^^(s, Sz, V, riz) = Horizontal_WCV(^_^^ (s, v) amd 

Vertical _WCV(sz, ^ ^ 

where 

Horizontal_WCV(^_^^ (s, v) = ||s|| < DTHR or 

(d,p,.(s,v) < DTHR and 0 < t,„(s,v) < TTHR), 

Vertical _WCV(sz, fz) = |sz| < ZTHR or 0 < Aoa(sz,Uz) < TCOA. 

The logical condition WCVt^^^ defines a family of well-clear boundary models where can be instanti- 
ated with any time variable and DTHR, TTHR, ZTHR, and TCOA are set to threshold values of interest. The fact 
that the time thresholds TTHR and TCOA can be zero allows for the definition of well-clear boundary models 
that do not depend on time thresholds. For instance, when TTHR = 0 and TCOA — 0, WCVt^ ^ specifies the loss 
of separation condition for a cylindrical volume of radius DTHR and half- height ZTHR around one of the aircraft. 
Indeed, in this case, WCVt^^^ is logically equivalent to the logical condition |js|| < DTHR and |sz| < ZTHR. 

The TCAS II RA core logic, provided in [5], is obtained by WCVr^^^, where DTHR, TTHR, ZTHR, and 
TCOA are set to the TCAS II thresholds DMOD, TAU, ZTHR, and TAU, respectively. The actual values 
of these thresholds are given in a table indexed by sensitivity levels based on the ownship’s altitude [8]. In 
the TCAS II RA logic, the logical condition d^p^{s,v) < DTHR in the horizontal check is called horizontal 
miss-distance filter and, in that condition, DTHR is set to the miss-horizontal distance threshold HMD, which 
is equal to DMOD. The well-clear boundary model defined in [6] is obtained by WCVt^^, where TCOA = TTHR. 

Henceforth, the well-clear models specified by WCVr, WCVr^^^, WCVt^^^, and WCVt^^ will be referred 
to as WC TAU, WC TAUMOD, WC TCPA, and WC TEP, respectively. The rest of this section studies 
properties and relations satisfied by these models. 

III. A. Symmetry 

A well-clear boundary model specified by for a given time variable t^^^, is symmetric if and only if 

W^C'Ft^a,r(s, Sz,v,Uz) = IFCyt^^^(-s, -Sz,-v, -Uz). (14) 

In other words, in a symmetric well-clear boundary model both the ownship and intruder aircraft have the 
same perception of being well clear or not. 

Theorem 3 (Symmetry). is symmetric, the well-clear boundary model specified by WCVt,„„. is sym- 

metric. Hence, by Theorem 1, the well-clear boundary models WC TAU, WC TAUMOD, WC TCPA, and 
WC TEP are symmetric for any choice of threshold values DTHR, TTHR, ZTHR, and TCOA. 

III.B. Inclusion 

Figures 2-5 illustrate the violation areas for the well-clear boundary models WC TAU, WC TAUMOD, 
WC_TCPA, and WC_TEP for the scenario of Eigure 1. The threshold values used in this scenario are 
DTHR = 1 nmi, TTHR = TCOA = 30 s, and ZTHR = 475 ft. The violation areas in these figures are similar to the 
conflict contours proposed in [9]. The points in these areas represent future locations of the ownship where 
a well-clear violation will occur assuming that the intruder aircraft continues its current trajectory and the 
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■-8 -6 -4 -2 0 2 4 


X (nmi) 


Figure 2: Violation areas of WCVr for scenario of Figure 1 
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y (nmi) 



■-8 -6 -4 -2 0 2 4 


X (nmi) 


Figure 3: Violation areas of for scenario of Figure 1 
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y (nmi) 
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Figure 4: Violation areas of WCVt^^^ for scenario of Figure 1 
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y (nmi) 



Figure 5: Violation areas of WCVt^^ for scenario of Figure 1 
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Figure 6: Overlay of violation areas for scenario of Figure 1 
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ownship either continues its current trajectory or instantaneously changes its direction but keeps its ground 
speed. 

Figure 6 overlays the violation areas for the four boundary models. This figure illustrates that for 
a common set of threshold values, the violation area of WC TAU is included in the violation area of 
WC TCPA, which is included in the violation area of WC TAUMOD, which is included in the violation 
area of WC TEP. Theorem 4 below states that this inclusion property always holds for any encounter 
geometry and choice of common threshold values. Theorem 4 is a consequence of Theorem 2. 

Theorem 4 (Inclusion). For all s,Sz,v,Vz and choice of threshold values DTHR, TTHR, ZTHR, and TCOA, the 
following implieations hold 

(i) WCVr{s,Sz,-v,Vz) => WCVt^^X^.,S:,,v,v^), 

(a) WCVr^^^{s,s^,^r,v^), and 

(Hi) WCVr^^,{s,s^,v,v^) WCVt^^{s,s^,v,v^). 

A key consequence of Theorem 4 is that of the four well-clear boundary models, WC TEP provides the 
most conservative safety margins in terms of having the largest violation area and the earliest time whereby 
a well-clear violation is defined to occur. The remaining models can be ordered from most conservative to 
least conservative as WC TAUMOD, WC TCPA, and WC TAU. 

III.C. Local Convexity 

As illustrated by Figures 2-5, the violation areas are not geometrically convex. However, Figures 3-5 show 
that from the point of view of the ownship, any ray that points towards the violation area has only one 
intersecting segment. This property is referred to as local convexity. It can be verified by inspection of 
Figure 2 that this property does not always hold in the case of WC TAU. A formal definition of local 
convexity follows. 

Definition 1 (Local convexity). A well-clear boundary model specified by WCVt„^^, for a given time variable 
t„ar, is locally convex if and only if there are no times 0 < ti < t 2 < ts < T such that 

1. the aircraft are not well clear at time t\, i.e., IFCVt„^^(s -|- Uv, -f tit’z, v, ri^), 

2. the aireraft are well clear at time t 2 , i.e., ^ IFC'yt„^^(s -|- t 2 V, Sz t 2 Vz,v,Vz), and 

3. the aircraft not well clear at time t^, i.e., IFC'yt„^^(s -|- t^w, Sz -f t 3 Vz,'v, Vz). 

Thus, a well-clear boundary model is locally convex if for any ownship straight-line trajectory there is at 
most one time interval where the aircraft are not well clear. 

Theorems. For any choice of threshold values, the well-clear boundary models WCTCPA, WCTAUMOD, 
and WC TEP are locally convex. 

As illustrated by Figure 2, the well-clear boundary model WC TAU is not locally convex for all choices 
of threshold values. In particular, it can be seen in Figure 1, assuming straight-line trajectories, that for the 
same encounter scenario the aircraft will have a well-clear violation at 91 s, 7 seconds later they will be well 
clear, and 7 seconds after being well clear, they will have another well-clear violation. 

Theorem 6. For some ehoices of threshold values, the well-clear boundary model WC TAU is not locally 
convex. 


IV. Well-Clear Violation Detection Algorithms 

A conflict detection algorithm checks whether or not a loss of separation is predicted to occur within 
a given period of time. Similarly, it is possible to design detection algorithms of well-elear violations for a 
given well-clear model. This section presents analytical formulations of such well-clear violation detection 
algoritms for WC TAUMOD, WC TCPA, and WC TEP. In particular, the functions detection WCV^.^^^, 
detection WCV, and detection WCV, are defined. These functions take as inputs the relative horizontal 

— ^cpa — •^ep 
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and vertical states of the aircraft and a lookahead time interval [B, T], with 0 < B < T, and return an interval 
of violation for WCVr^^^, WCVt^^^, and WCVt^_^, respectively. Assuming accurate vector information and 
constant velocities, it has been formally proved that these functions correctly and completely characterize 
the aircraft states that lead to a well-clear violation, within the lookahead time interval, for their respective 
models. 

To define an algorithm detection WCVj^^^ for a given time variable Aid it is necessary to define functions 
that detect time intervals of violation for the horizontal and vertical dimension. Since the vertical check 
Vertical WCV (Formula (13)) is independent of Aan the algorithm that computes the time interval for a 
vertical well-clear violation is the same for any definition in the family of WCVt^^^ models. Formula (15) 
specifies an algorithm for detecting such vertical well-clear violations. The function detection VWCV has as 
inputs a relative vertical state and a lookahead time interval [B,T\. It returns a time interval within [B,T] 
when a vertical well-clear violation will occur. The interval is empty if no such violation occurs. 


detection VWCV(sj:, Uz, i3, T) = 

if Uz = 0 cuid |sz| < ZTHR then [i?,r] 
elsif Vz = 0 then [T, B] 

else let [ti, ^2] = 'vertical entry _exit(sz, Uz) in 
if T < ti or t 2 < B then [T, B] 
else [max(i?, ti), min(T, ^2)] 
endif 
endif , 


where 


vertical entry _exit(Sz, Uz) = 

let H = max(ZTHR, TCOA |uz|) in 

-sign(uz)i? - Sz sign(vz)ZTHR - Sz, 

[ ’ J’ 

Vz Vz 

The horizontal check Horizontal_WCVj^^^ (Formula (13)) depends on actual definition of the time variable 
tvar- Hence, a horizontal detection algorithm for each particular definition of Aar is necessary. Formula (17), 
Formula (18), and Formula (19) specify horizontal detection algorithms for WC TAUMOD, WC TCPA, 
and WC TEP, respectively. The functions specified by these formulas have as inputs a relative horizontal 
state and a lookahead time T. They return a time interval within [B, T] when a horizontal well-clear violation 
for their respective model will occur. The interval is empty if no such violation occurs. 


detection _HWCVz.^^^(s, V, T) = 


let a = V , 

6 = 2 (s • v) + TTHRv^, 
c = + TTHR (s • v) - DTHR^ in 

if a = 0 cuid ||s|| < DTHR then [0,T] 
elsif ||s|| < DTHR then [0, min(T, 0(s, v, DTHR, 1))] 
elsif s • V > 0 or — 4ac < 0 then [T, 0] 

—b — 


else let t = 


2a 


if A(s,v,DTHR) > 0 and t <T then 
[max(0, t), min(T, 0(s, v, DTHR, 1))] 
else [T, 0] 
endif 
endif. 


(17) 
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detection _HWCV(^p^(s, V, T) = 

if ||v|| = 0 and ||s|| < DTHR then [0,T] 
elsif ||v|j =0 then [T, 0] 

elsif ||s|| < DTHR then [0, min(T, 0(s, v, DTHR, 1))] 

elsif s • V > 0 then [T, 0] 

elsif ||s + v)v|| > DTHR then [T, 0] 

elsif A(s,v,DTHR) < 0 and t^p^{s,v) — TTHR > T then [T, 0] 

elsif A(s,v,DTHR) < 0 then 

[max(0, fppa(s, v) - TTHR), min(T, fpp,(s, v))] 
else let = min(0(s, v, DTHR, —1), fppp(s, v) — TTHR) in 
if > T then [T, 0] 
else [max(0, f„i„), min(T, 0(s, v, DTHR, 1))] 
endif 
endif . 


detection HWCVj^p (s, V, T) = 

if |jv|j = 0 and ||s|| < DTHR then [0,T] 
elsif ||v|| =0 then [T, 0] 

elsif ||s|| < DTHR then [0, min(T, 0(s, v, DTHR, 1))] 

( 19 ) 

elsif s • V > 0 then [T, 0] 

elsif A(s, v,DTHR) < 0 or 0((s, v, DTHR, -1) - TTHR > T then [T, 0] 
else [(max(0, 0(s, v, DTHR, -1) - TTHR), min(T, 0(s, v, DTHR, 1))] 
endif. 

Given a definition of Horizontal WCV^^^^, Formula 20 specifies a function that computes a time interval 
of violation for The function detection WCV^ has as inputs a relative state and a lookahead 

time interval \B,T]. It returns a time interval when a violation of WCVt^^^ will occur. The interval 

is empty if no such violation occurs. Theorem 7 states that detection WCVj^^^ completely characterizes the 
relative aircraft states that lead to a well-clear violation of for one of r„pd, t^p,,, or t^p, within 

a lookahead time interval [B,T] and assuming straight-line trajectories for both aircraft. 


detection_WCVj^^^ (s, Sz, v, Vz, B, T) = 

let [fi, ^2] = detection VWCV(sj:, i 3 , r) in 
if t\ > ^2 then [T, B] 

elsif ti = t2 and Horizontal_WCVj^^^(s -|- tiv, v) then[fi,fi] 
elsif t\ = ^2 then [T, B] 

else let tppj = detection HWCVj^^^^ (s -|- tiV, v, ^2 — G) in 

[bn + tl, taut + t\\ 

endif. 

Theorem 7. Let he one of or The funetion detection WCV^^^^ is a correct and complete 

detection algorithm for WCVt^^p, i.e., for all relative states s,Sz,'v,Vz, time interval [B^T], with 0 < B < T, 
and t € [B,T], WCVt^ari^ + tv, Sz + tVz,v,Vz) holds if and only if t £ [tiu,t„ut], where 

[tin, tout] = detection_WCV^^^^{s,Sz,v,Vz, B,T). 
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V. Conclusion 


A family of well-clear boundary models is presented. This family generalizes the TCAS II Resolution 
Logic with different possible definition of horizontal time variables including tau, modified tau, time to 
closest point of approach, and time to entry point. Analytical techniques are used to study the properties 
of this model. For instance, it has been formally proved that the well-clear model based on time to entry 
point is more conservative than tau, modified tau, and time to closest point of approach for any scenario 
and any common choice of threshold values. Furthermore, it is shown that all the models in this family are 
symmetric, i.e., the ownship and intruder aircraft have the same perception of being well-clear or not at any 
moment in time. Except for the model based on tau, all the models are locally convex meaning that there 
is at most one interval of time when the aircraft are not well-clear, assuming straight-line trajectories. 

Detection algorithms for a family of well-clear boundary models are proposed which compute the time 
interval of violation within a given lookahead time interval. These algorithms could be used in the imple- 
mentation of airborne and ground capabilities that allow UAS pilots to avoid encounter scenarios that are 
not well clear. 

The mathematical development presented in this paper has been mechanically verified in the Prototype 
Verification System (PVS) [7]. This level of rigor is justified by the safety-critical nature of the well-clear 
concept in the integration of Unmanned Aerial Vehicles into the National Aerospace System. 
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